[java-identity-provider] branch dev/IDP-2183 updated: IDP-2183 - Use of JS in views needs to be hardened via CSP

Scott Cantor cantor.2 at osu.edu
Tue Oct 24 19:24:38 UTC 2023 

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch dev/IDP-2183
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=8b2101741073b78f950e8e77ca9034d3a088590c

The following commit(s) were added to refs/heads/dev/IDP-2183 by this push:
     new 8b2101741 IDP-2183 - Use of JS in views needs to be hardened via CSP
8b2101741 is described below

commit 8b2101741073b78f950e8e77ca9034d3a088590c
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Oct 24 15:24:34 2023 -0400

    IDP-2183 - Use of JS in views needs to be hardened via CSP
    
    https://shibboleth.atlassian.net/browse/IDP-2183
    
    Replace setHeader with addHeader calls.
    Harden default CSP header with base-uri block.
---
 idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/filters.xml  | 2 +-
 .../src/main/resources/net/shibboleth/idp/module/conf/idp.properties  | 2 +-
 .../src/main/resources/net/shibboleth/idp/module/views/admin/hello.vm | 2 +-
 .../resources/net/shibboleth/idp/module/views/admin/unlock-keys.vm    | 2 +-
 .../shibboleth/idp/module/views/client-storage/client-storage-read.vm | 4 ++--
 .../idp/module/views/client-storage/client-storage-write.vm           | 4 ++--
 .../src/main/resources/net/shibboleth/idp/module/views/error.vm       | 2 +-
 .../net/shibboleth/idp/module/views/intercept/attribute-release.vm    | 2 +-
 .../net/shibboleth/idp/module/views/intercept/expiring-password.vm    | 2 +-
 .../net/shibboleth/idp/module/views/intercept/impersonate.vm          | 2 +-
 .../net/shibboleth/idp/module/views/intercept/terms-of-use.vm         | 2 +-
 .../src/main/resources/net/shibboleth/idp/module/views/login.vm       | 2 +-
 .../main/resources/net/shibboleth/idp/module/views/logout-complete.vm | 2 +-
 .../resources/net/shibboleth/idp/module/views/logout-propagate.vm     | 2 +-
 .../src/main/resources/net/shibboleth/idp/module/views/logout.vm      | 2 +-
 .../resources/net/shibboleth/idp/module/views/spnego-unavailable.vm   | 2 +-
 .../src/main/resources/net/shibboleth/idp/module/views/user-prefs.vm  | 4 ++--
 .../src/main/resources/net/shibboleth/idp/views/logout/propagate.vm   | 2 +-
 .../src/main/resources/net/shibboleth/idp/views/logout/saml-async.vm  | 2 +-
 19 files changed, 22 insertions(+), 22 deletions(-)

diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/filters.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/filters.xml
index 2b1cfa9a4..704cff616 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/filters.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/filters.xml
@@ -23,7 +23,7 @@
             <map>
                 <entry key="Strict-Transport-Security" value="%{idp.hsts:max-age=31536000}" />
                 <entry key="X-Frame-Options" value="%{idp.frameoptions:DENY}" />
-                <entry key="Content-Security-Policy" value="%{idp.csp:frame-ancestors 'none';}"/>
+                <entry key="Content-Security-Policy" value="%{idp.csp:frame-ancestors 'none'; base-uri 'none';}"/>
             </map>
         </property>
     </bean>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/idp.properties b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/idp.properties
index d91c58d67..ca5cb4ec3 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/idp.properties
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/idp.properties
@@ -46,7 +46,7 @@ idp.csrf.enabled = true
 # X-Frame-Options value, set to DENY or SAMEORIGIN to block framing
 #idp.frameoptions = DENY
 # Content-Security-Policy value, set to match X-Frame-Options default
-#idp.csp = frame-ancestors 'none';
+#idp.csp = frame-ancestors 'none'; base-uri 'none';
 
 # Set to false to disable filter that forcibly applies UTF-8 encoding
 #idp.encoding.forceUTF8 = true
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/admin/hello.vm b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/admin/hello.vm
index 67dc673b5..200f1d47a 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/admin/hello.vm
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/admin/hello.vm
@@ -12,7 +12,7 @@
 ## environment - Spring Environment object for property resolution
 ## custom - arbitrary object injected by deployer
 ##
-$response.setHeader("Content-Security-Policy", "script-src 'none'")
+$response.addHeader("Content-Security-Policy", "script-src 'none'")
 <!DOCTYPE html>
 <html>
     <head>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/admin/unlock-keys.vm b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/admin/unlock-keys.vm
index a124a62b4..447f03162 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/admin/unlock-keys.vm
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/admin/unlock-keys.vm
@@ -13,7 +13,7 @@
 #set ($titleSuffix = $springMacroRequestContext.getMessage("idp.unlock-keys.title", "Attended Restart Key Unlock"))
 #set ($eventId = $profileRequestContext.getSubcontext("org.opensaml.profile.context.EventContext").getEvent())
 #set ($state = $flowRequestContext.getCurrentState().getId())
-$response.setHeader("Content-Security-Policy", "script-src 'none'")
+$response.addHeader("Content-Security-Policy", "script-src 'none'")
 <!DOCTYPE html>
 <html>
     <head>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/client-storage/client-storage-read.vm b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/client-storage/client-storage-read.vm
index 8bfe9a299..882b22217 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/client-storage/client-storage-read.vm
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/client-storage/client-storage-read.vm
@@ -17,10 +17,10 @@
 #set ($titleSuffix = $springMacroRequestContext.getMessage("idp.client-storage-read.suffix", "Loading Session Information"))
 ##
 #set ($onLoad = "doLoad()")
-$response.setHeader("Content-Security-Policy", "script-src-attr 'unsafe-hashes' 'sha256-$cspDigester.apply($onLoad)'")
+$response.addHeader("Content-Security-Policy", "script-src-attr 'unsafe-hashes' 'sha256-$cspDigester.apply($onLoad)'")
 ## Nonce for dynanmic scripts.
 #set ($nonce = $cspNonce.generateIdentifier())
-$response.setHeader("Content-Security-Policy", "script-src-elem 'nonce-$nonce'")
+$response.addHeader("Content-Security-Policy", "script-src-elem 'nonce-$nonce'")
 <!DOCTYPE html>
 <html>
     <head>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/client-storage/client-storage-write.vm b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/client-storage/client-storage-write.vm
index f03a249ef..dc673368e 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/client-storage/client-storage-write.vm
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/client-storage/client-storage-write.vm
@@ -17,10 +17,10 @@
 #set ($titleSuffix = $springMacroRequestContext.getMessage("idp.client-storage-write.suffix", "Saving Session Information..."))
 ##
 #set ($onLoad = "doSave()")
-$response.setHeader("Content-Security-Policy", "script-src-attr 'unsafe-hashes' 'sha256-$cspDigester.apply($onLoad)'")
+$response.addHeader("Content-Security-Policy", "script-src-attr 'unsafe-hashes' 'sha256-$cspDigester.apply($onLoad)'")
 ## Nonce for dynanmic scripts.
 #set ($nonce = $cspNonce.generateIdentifier())
-$response.setHeader("Content-Security-Policy", "script-src-elem 'nonce-$nonce'")
+$response.addHeader("Content-Security-Policy", "script-src-elem 'nonce-$nonce'")
 <!DOCTYPE html>
 <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
     <head>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/error.vm b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/error.vm
index f3b53c419..efc943148 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/error.vm
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/error.vm
@@ -47,7 +47,7 @@
     $response.setStatus(500)
 #end
 ##
-$response.setHeader("Content-Security-Policy", "script-src 'none'")
+$response.addHeader("Content-Security-Policy", "script-src 'none'")
 <!DOCTYPE html>
 <html>
     <head>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/intercept/attribute-release.vm b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/intercept/attribute-release.vm
index 32f9e30f7..3e9e547fa 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/intercept/attribute-release.vm
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/intercept/attribute-release.vm
@@ -25,7 +25,7 @@
 #set ($rpOrganizationName = $rpUIContext.organizationDisplayName)
 #set ($replaceDollarWithNewline = true)
 ##
-$response.setHeader("Content-Security-Policy", "script-src 'none'")
+$response.addHeader("Content-Security-Policy", "script-src 'none'")
 <!DOCTYPE html>
 <html>
     <head>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/intercept/expiring-password.vm b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/intercept/expiring-password.vm
index 4523ab4c9..665c96707 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/intercept/expiring-password.vm
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/intercept/expiring-password.vm
@@ -16,7 +16,7 @@
 ## environment - Spring Environment object for property resolution
 ## custom - arbitrary object injected by deployer
 ##
-$response.setHeader("Content-Security-Policy", "script-src 'none'")
+$response.addHeader("Content-Security-Policy", "script-src 'none'")
 <!DOCTYPE html>
 <html>
     <head>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/intercept/impersonate.vm b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/intercept/impersonate.vm
index 8e4b40786..192be8904 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/intercept/impersonate.vm
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/intercept/impersonate.vm
@@ -14,7 +14,7 @@
 ## custom - arbitrary object injected by deployer
 ##
 #set ($rpContext = $profileRequestContext.getSubcontext('net.shibboleth.profile.context.RelyingPartyContext'))
-$response.setHeader("Content-Security-Policy", "script-src 'none'")
+$response.addHeader("Content-Security-Policy", "script-src 'none'")
 <!DOCTYPE html>
 <html>
     <head>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/intercept/terms-of-use.vm b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/intercept/terms-of-use.vm
index c3a0460d2..63e40ed07 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/intercept/terms-of-use.vm
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/intercept/terms-of-use.vm
@@ -15,7 +15,7 @@
 #set ($serviceName = $rpUIContext.serviceName)
 #set ($rpOrganizationLogo = $rpUIContext.getLogo())
 ##
-$response.setHeader("Content-Security-Policy", "script-src 'none'")
+$response.addHeader("Content-Security-Policy", "script-src 'none'")
 <!DOCTYPE html>
 <html>
     <head>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/login.vm b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/login.vm
index 2ed0cd253..43965dc80 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/login.vm
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/login.vm
@@ -23,7 +23,7 @@
 #set ($username = $authenticationContext.getSubcontext('net.shibboleth.idp.authn.context.UsernamePasswordContext', true).getUsername())
 ##
 #set ($onClick = "this.childNodes[0].nodeValue='#springMessageText('idp.login.pleasewait', 'Logging in, please wait...')'")
-$response.setHeader("Content-Security-Policy", "script-src-attr 'unsafe-hashes' 'sha256-$cspDigester.apply($onClick)'")
+$response.addHeader("Content-Security-Policy", "script-src-attr 'unsafe-hashes' 'sha256-$cspDigester.apply($onClick)'")
 <!DOCTYPE html>
 <html>
     <head>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/logout-complete.vm b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/logout-complete.vm
index 93e9ac9ea..fcadf0c0f 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/logout-complete.vm
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/logout-complete.vm
@@ -18,7 +18,7 @@
 ##
 #set ($activeIdPSessions = $logoutContext and !$logoutContext.getIdPSessions().isEmpty())
 #set ($activeSPSessions = $logoutContext and !$logoutContext.getSessionMap().isEmpty())
-$response.setHeader("Content-Security-Policy", "script-src 'none'")
+$response.addHeader("Content-Security-Policy", "script-src 'none'; base-uri 'none'")
 <!DOCTYPE html>
 <html>
     <head>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/logout-propagate.vm b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/logout-propagate.vm
index 675968882..e2fdc41ba 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/logout-propagate.vm
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/logout-propagate.vm
@@ -19,7 +19,7 @@
 ## custom - arbitrary object injected by deployer
 ##
 #set ($hidden = $environment.getProperty("idp.logout.propagationHidden", "false"))
-$response.setHeader("Content-Security-Policy", "script-src 'unsafe-inline' 'self'")
+$response.addHeader("Content-Security-Policy", "base-uri 'none'; script-src 'unsafe-inline' 'self'")
 <!DOCTYPE html>
 <html>
     <head>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/logout.vm b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/logout.vm
index dc2397cb0..f5e6d0cc4 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/logout.vm
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/logout.vm
@@ -22,7 +22,7 @@
 #end
 #set ($promptForIdP = $logoutContext and !$logoutContext.getIdPSessions().isEmpty())
 #set ($promptForSP = $logoutContext and !$logoutContext.getSessionMap().isEmpty())
-$response.setHeader("Content-Security-Policy", "script-src 'none'")
+$response.addHeader("Content-Security-Policy", "script-src 'none'; base-uri 'none'")
 <!DOCTYPE html>
 <html>
     <head>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/spnego-unavailable.vm b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/spnego-unavailable.vm
index 6fed743b6..0a8c92a36 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/spnego-unavailable.vm
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/spnego-unavailable.vm
@@ -15,7 +15,7 @@
 ##
 #set ($eventKey = $springMacroRequestContext.getMessage("SPNEGOUnavailable", "spnego-unavailable"))
 #set ($onLoad = "window.location = '$errorUrl'")
-$response.setHeader("Content-Security-Policy", "script-src-attr 'unsafe-hashes' 'sha256-$cspDigester.apply($onLoad)'")
+$response.addHeader("Content-Security-Policy", "script-src-attr 'unsafe-hashes' 'sha256-$cspDigester.apply($onLoad)'")
 <!DOCTYPE html>
 <html>
     <head>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/user-prefs.vm b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/user-prefs.vm
index d790ddb1a..becd24fc4 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/user-prefs.vm
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/user-prefs.vm
@@ -12,9 +12,9 @@
 ##
 #set ($onLoad = "load('spnego')")
 #set ($onClick = "check(this)")
-$response.setHeader("Content-Security-Policy", "script-src-attr 'unsafe-hashes' 'sha256-$cspDigester.apply($onLoad)','sha256-$cspDigester.apply($onClick)'")
+$response.addHeader("Content-Security-Policy", "script-src-attr 'unsafe-hashes' 'sha256-$cspDigester.apply($onLoad)','sha256-$cspDigester.apply($onClick)'")
 ## Hash of user-prefs.js (being injected inline below).
-$response.setHeader("Content-Security-Policy", "script-src-elem 'unsafe-hashes' 'sha256-mXQMhpzvwZ/f5iKzcm/iFe50L/0b7cNjsvcFVu/PMTg='")
+$response.addHeader("Content-Security-Policy", "script-src-elem 'unsafe-hashes' 'sha256-mXQMhpzvwZ/f5iKzcm/iFe50L/0b7cNjsvcFVu/PMTg='")
 <!DOCTYPE html>
 <html>
     <head>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/views/logout/propagate.vm b/idp-conf-impl/src/main/resources/net/shibboleth/idp/views/logout/propagate.vm
index 34db86bf0..8b2a454cf 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/views/logout/propagate.vm
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/views/logout/propagate.vm
@@ -50,7 +50,7 @@
         #end
     </ol>
     <script src="$request.getContextPath()/js/jquery-3.6.0.min.js" integrity="sha256-/xUj+3OJU5yExlq6GSYGSHk7tPXikynS7ogEvDej/m4="></script>
-    <script>
+    <script #if ($nonce)nonce="$nonce"#end>
     <!--
         function check_status() {
             // Check every property of the object.
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/views/logout/saml-async.vm b/idp-conf-impl/src/main/resources/net/shibboleth/idp/views/logout/saml-async.vm
index 836f51251..49b9d2021 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/views/logout/saml-async.vm
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/views/logout/saml-async.vm
@@ -9,7 +9,7 @@
 ## environment - Spring Environment object for property resolution
 ## custom - arbitrary object injected by deployer
 ##
-$response.setHeader("Content-Security-Policy", "script-src 'none'")
+$response.addHeader("Content-Security-Policy", "script-src 'none'; base-uri 'none'")
 <!DOCTYPE html>
 <html>
 <head>

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.

More information about the commits mailing list